CVE-2025-29776
Last modified
CVE-2025-29776 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` causes an immediate infinite loop of timers to be executed on the canister, each timer attempting to clean up the global state of the previous timer. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` causes an immediate infinite loop of timers to be executed on the canister, each timer attempting to clean up the global state of the previous timer. The infinite loop will occur with any valid invocation of `setTimer`. The problem has been fixed as of Azle version `0.30.0`. As a workaround, if a canister is caught in this infinite loop after calling `setTimer`, the canister can be upgraded and the timers will all be cleared, thus ending the loop.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-29776?
How severe is CVE-2025-29776?
How do I fix CVE-2025-29776?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-29770vLLM is a high-throughput and memory-efficient inference and…6.5
- CVE-2025-29771HtmlSanitizer is a client-side HTML Sanitizer. Versions prio…5.3
- CVE-2025-29772OpenEMR is a free and open source electronic health records …6.1
- CVE-2025-29773Froxlor is open-source server administration software. A vul…7.8
- CVE-2025-29774xml-crypto is an XML digital signature and encryption librar…9.3
- CVE-2025-29775xml-crypto is an XML digital signature and encryption librar…9.3
- CVE-2025-29778Kyverno is a policy engine designed for cloud native platfor…8
- CVE-2025-29779Post-Quantum Secure Feldman's Verifiable Secret Sharing prov…5.4
- CVE-2025-2978A vulnerability was found in WCMS 11. It has been rated as c…9.8
- CVE-2025-29780Post-Quantum Secure Feldman's Verifiable Secret Sharing prov…5.8
- CVE-2025-29781The Bare Metal Operator (BMO) implements a Kubernetes API fo…6.5
- CVE-2025-29782WeGIA is Web manager for charitable institutions A Stored Cr…5.4
Are you affected by CVE-2025-29776?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST